Fix weather satellite decoder security, architecture, and race conditions

Security: replace path traversal-vulnerable str().startswith() with
is_relative_to(), anchor path checks to app root, strip filesystem
paths from error responses, add decoder-level path validation.

Architecture: use safe_terminate/register_process for subprocess
lifecycle, replace custom SSE generator with sse_stream(), use
centralized validate_* functions, remove unused app.py declarations.

Bugs: add thread-safe singleton locks, protect _images list across
threads, move blocking process.wait() to async daemon thread, fix
timezone handling for tz-aware datetimes, use full path for image
deduplication, guard TLE auto-refresh during tests, validate
scheduler parameters to avoid 500 errors.

Docker: pin SatDump to v1.2.2 and slowrx to ca6d7012, document
INTERCEPT_IMAGE fallback pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -136,16 +136,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && make \
     && cp acarsdec /usr/bin/acarsdec \
     && rm -rf /tmp/acarsdec \
-    # Build slowrx (SSTV decoder)
+    # Build slowrx (SSTV decoder) — pinned to known-good commit
     && cd /tmp \
-    && git clone --depth 1 https://github.com/windytan/slowrx.git \
+    && git clone https://github.com/windytan/slowrx.git \
     && cd slowrx \
+    && git checkout ca6d7012 \
     && make \
     && install -m 0755 slowrx /usr/local/bin/slowrx \
     && rm -rf /tmp/slowrx \
-    # Build SatDump (weather satellite decoder - NOAA APT & Meteor LRPT)
+    # Build SatDump (weather satellite decoder - NOAA APT & Meteor LRPT) — pinned to v1.2.2
     && cd /tmp \
-    && git clone --depth 1 https://github.com/SatDump/SatDump.git \
+    && git clone --depth 1 --branch 1.2.2 https://github.com/SatDump/SatDump.git \
     && cd SatDump \
     && mkdir build && cd build \
     && cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_GUI=OFF -DCMAKE_INSTALL_LIBDIR=lib .. \